The Liquid Network experienced a near standstill after approximately $320 million in Bitcoin exited its federation reserve via an abnormal peg-out procedure.
The events began on Sept. 6 when a customer submitted 4,000 L-BTC to SideSwap's peg-out service, which is designed to convert Bitcoin represented on the Liquid sidechain back into native BTC on the main network. SideSwap reported that the request cleared normal authorization processes, prompting the Liquid Federation to release about 3,996 BTC. The funds subsequently moved to an address holding roughly 3,998.5 BTC.
In response to the incident, Liquid disabled its bridge nodes, and SideSwap suspended all swaps, peg-ins, and peg-outs. Digital asset exchanges also paused or prepared to pause L-BTC deposits and withdrawals while operators investigated.
The individuals controlling the Bitcoin later identified themselves via on-chain messages as whitehat hackers, stating they intend to return most of the funds once the underlying network bug is fixed.
Withdrawal Followed System Rules
Both Liquid and SideSwap confirmed that the incident did not involve compromised signing credentials. The withdrawal utilized SideSwap's valid Peg-out Authorization Key (PAK), and Liquid stated that neither that key nor other federation keys were compromised.
Instead, SideSwap indicated that Blockstream traced the 4,000 L-BTC presented for redemption to a flaw in Elements, the open-source software underlying Liquid. Blockchain security firm Bitslab noted that at least 11 of Liquid's 15 functionaries ultimately signed the transaction, indicating that secure keys offer limited protection if signers are presented with an invalid state that appears legitimate.
Whitehats Demand a Patch
The holders of the funds have communicated with Blockstream using Bitcoin transactions containing OP_RETURN messages. According to Galaxy Digital research head Alex Thorn, Blockstream initially contacted the holder, who responded with plans to return most of the Bitcoin.
A subsequent message conditioned the return of the funds on Blockstream fixing the bug and ensuring that every node is patched. Before normal operations can resume, the federation must identify and remediate the Elements flaw, distribute the fix across nodes, and reconcile its reserves to guarantee that legitimate outstanding L-BTC remains backed one-for-one.
